Question: Why does TPM integration sign PCR digests via SPDM MEASUREMENTS instead of TPM2_Quote

[magickli1]

Summary

I am integrating platform attestation with TPM as the Root of Trust on top of libspdm / spdm-emu and would like to understand the design intent behind the current TPM-backed measurement path.

Today, the TPM stub (spdm_device_secret_lib_tpm) appears to:

1. Read PCR values via Esys_PCR_Read and place digests into GET_MEASUREMENTS.measurement_record[] as DMTF measurement blocks (libspdm_fill_measurement_image_hash_block() in meas.c).
2. Sign the SPDM MEASUREMENTS transcript with the responder storage key (TPM_RESP_KEY) when SignatureRequested=1 (libspdm_generate_measurement_signature() → libspdm_responder_data_sign()).
3. Leave libspdm_measurement_opaque_data() as a placeholder (sequential bytes 0,1,2,...) with no TPM2_Quote, no IAK / attestation key, and no TPM2B_ATTEST in opaque_data.

Provisioning (setup-tpm.sh, keys.h) also defines only TPM_RESP_KEY / TPM_RESP_CERT_CHAIN (slot0), not a separate IAK for attestation.

---

Current vs expected behavior

What the code does today

Step	Implementation	File
PCR read	libspdm_tpm_read_pcr() → Esys_PCR_Read	cryptlib_openssl/tpm/tpm.c
PCR in response	DMTF blocks in measurement_record[]	spdm_device_secret_lib_tpm/meas.c
MEASUREMENTS signature	TPM_RESP_KEY signs SPDM L1/L2 transcript	sign.c, libspdm_rsp_measurements.c
Opaque data	Stub 0,1,2,...; no Quote	meas.c → libspdm_measurement_opaque_data()
IAK / attestation key	Not provisioned	keys.h, setup-tpm.sh

What I expected for TPM-rooted platform attestation

Evidence	Suggested SPDM carrier
PCR digests	GET_MEASUREMENTS.measurement_record[]
TPM2_Quote (TPM2B_ATTEST + TPMT_SIGNATURE)	GET_MEASUREMENTS.opaque_data[] (e.g. OpaqueDataFmt1 + TCG element)
IAK certificate chain	GET_CERTIFICATE slot1 (separate from device identity)
TCG Event Log (BIOS / IMA)	GET_MEASUREMENT_EXTENSION_LOG.mel[]

Quote qualifying data would bind to GET_MEASUREMENTS request nonce[32], not the response nonce.

Important distinction: MEASUREMENTS.signature covers the SPDM transcript (device identity). TPM Quote should not replace that field; it attests PCR state via the TPM attestation key (IAK).

---

Questions for maintainers

1. Was omitting TPM2_Quote intentional?
   Is the current model (“PCR in measurement_record + device key signs SPDM transcript”) considered sufficient for “TPM-backed measurements” in libspdm’s scope?

2. Trust boundary
   Without Quote, how should a verifier distinguish:

   • PCR values read honestly from TPM, vs.
   • PCR digests assembled by untrusted firmware/software and signed only by the SPDM device key?

3. SPDM field semantics
   Should TPM Quote live in MEASUREMENTS.opaque_data (not in signature)?
   Is there an upstream preference for SPDM_REGISTRY_ID_TCG + TPM2B_ATTEST || TPMT_SIGNATURE under OpaqueDataFmt1?

4. Key separation
   Is there guidance on slot0 device identity key vs slot1 IAK for Quote verification?
   Or is reusing the same cert chain for all slots acceptable for the reference TPM stub?
   (Note: libspdm_read_responder_public_certificate_chain_per_slot() currently reads TPM_RESP_CERT_CHAIN regardless of slot_id.)

5. Roadmap
   Are there existing issues, design notes, or planned work to add Quote / IAK / real Event Log to spdm_device_secret_lib_tpm?

[steven-bellock]

@itsManjeet

[itsManjeet]

Hi @magickli1,

I initially tried using TPM2_Quote, but ran into some issues and did not get a clean implementation working at the time.

I’ll revisit this when I have some time. In the meantime, if you already have a patch or prototype for the TPM2_Quote / IAK path, please feel free to share it. I’d be happy to take a look and compare it with the current TPM-backed measurement flow.

[magickli1]

Hi @itsManjeet,

Thanks for the reply. I do not have a mergeable TPM2_Quote / IAK patch yet. Below is the approach I want to use, for discussion before coding. Happy to revise based on what blocked your earlier Quote attempt.

1. Problem and goal

Today’s sample path is:

PCR_Read → DMTF measurement blocks → SPDM MEASUREMENTS.signature (device / identity key)
opaque_data = placeholder

That proves SPDM identity and transcript integrity, but not that the PCR bytes were attested by the TPM. Software between TPM and libspdm can still substitute digests.

Goal: keep the SPDM transcript signature, and add a TPM-native Quote so a verifier can check both layers independently.

2. Trust model (two signatures)

GET_MEASUREMENTS (GenerateSignature=1, nonce N, slot_id = identity slot, usually 0)
        │
        ▼
MEASUREMENTS response
  ├── measurement_record[]     PCR digests as DMTF blocks (from PCR_Read)
  ├── opaque_data              TPM2_Quote evidence (this approach)
  ├── nonce                    responder nonce (SPDM only; not Quote freshness)
  └── signature                SPDM transcript signature with identity key

Layer	Field	Key	Proves
SPDM	MEASUREMENTS.signature	Identity key (GET_MEASUREMENTS.slot_id)	Responder identity + transcript (including opaque)
TPM	Quote in opaque_data	Restricted IAK	TPM-selected PCRs + freshness

Quote never replaces MEASUREMENTS.signature.

3. Freshness

TPM2_Quote.qualifyingData  = GET_MEASUREMENTS request nonce   // exactly 32 bytes
TPMS_ATTEST.extraData     = same 32 bytes
Verifier: extraData == the nonce it sent

Rules:

• Generate Quote only when GenerateSignature is set (request nonce present).
• Do not use MEASUREMENTS.nonce (responder-chosen) as Quote freshness.
• Do not fold SPDM 1.3 Context into qualifyingData.

4. Keys and slots

Object	Role	SPDM	TPM
Identity (IDevID-like)	SPDM transcript signing	Slot 0	Existing responder key handle
IAK (restricted AK)	TPM2_Quote only	Slot 1 cert chain (GET_DIGESTS / GET_CERTIFICATE)	New persistent IAK handle (lab sample, e.g. 0x81010100)

Opaque carries iak_slot_id (sample default 1). It is independent of GET_MEASUREMENTS.slot_id:

• Request slot_id → which key signs the SPDM transcript (should stay 0).
• iak_slot_id → which cert verifies the Quote.

Required fence (SPDM 1.2): a restricted IAK must not sign ordinary SPDM messages. When the selected slot is the IAK slot, the responder shall reject CHALLENGE / MEASUREMENTS transcript / KEY_EXCHANGE signing. CI negative case: GET_MEASUREMENTS.slot_id == iak_slot_id.

IAK public attributes (TCG AK): restricted | sign | fixedTPM, not decrypt; sample: ECC P-256, ECDSA+SHA-256.

5. Opaque encoding format

Outer: SPDM OpaqueDataFmt1 (DSP0274). Prefer SPDM_REGISTRY_ID_TCG; Vendor ID from TCG TPM Vendor ID Registry §3 TPM Hardware Interface Vendor ID (16-bit, matches SPDM TCG SVH vendor_id; e.g. Intel 0x8086, Infineon 0x15D1, Microsoft 0x1414 — use the platform TPM’s already-registered value; do not invent a new one).

Inner OpaqueElementData (little-endian lengths; TSS2 MU for TPM structs):

version (1)
iak_slot_id          // sample: 1; forbid 0xF
attest_length        // uint16 LE
signature_length     // uint16 LE
MU(TPM2B_ATTEST)
MU(TPMT_SIGNATURE)

Header = 6 bytes.

Verifier:

1. Verify SPDM transcript signature with the identity slot.
2. Parse Fmt1 + payload; GET_CERTIFICATE(iak_slot_id); verify Quote signature.
3. Check magic / type == TPM_ST_ATTEST_QUOTE / extraData == request nonce.
4. Read pcrSelect from attest; rebuild PCR bytes from DMTF blocks.
5. Recompute pcrDigest with the Quote signing-scheme hash (inScheme), not the PCR bank hash; compare to attest.

If the full opaque element cannot fit (SPDM_MAX_OPAQUE_DATA_SIZE / response budget), fail the response — never truncate. No placeholder 0,1,2,... opaque when Quote is enabled/required.

6. Collection algorithm (atomic)

Per signed GET_MEASUREMENTS, one path (no process-global nonce/PCR/Quote cache):

1. Map DMTF indexes → one PCR bank + TPML_PCR_SELECTION.
2. One PCR_Read for the full selection → build DMTF blocks.
3. TPM2_Quote with the same selection + request nonce as qualifyingData.
4. Consistency: recompute pcrDigest from collected PCRs (ascending PCR index; scheme hash); bounded retry (e.g. 3) on PCR race.
5. Encode opaque evidence with iak_slot_id.
6. Sign SPDM transcript with the identity slot.

Selected: atomic measurement HAL (one-shot collect such as libspdm_collect_measurement_evidence). Do not stash TPM transaction state in core spdm_context.

Buffer maxima (document in header): attest ≤ 1024, ECDSA-P256 sig ≤ 128. Quote via ESAPI Esys_Quote (not OpenSSL TPM provider EVP).

7. Feedback asked

1. Does this overall shape look right vs the current TPM-backed measurement flow?
2. What blocked your earlier Quote attempt (HAL/nonce, IAK/ESAPI vs provider, opaque size, …)?
3. OK with sample iak_slot_id = 1 + mandatory reject of transcript signing on that slot under SPDM 1.2?

[magickli1]

Hi @itsManjeet,
I’d like to clarify the design I have in mind. The intended TPM measurement path is a two-layer model: Quote supplements SPDM evidence and does not replace MEASUREMENTS.signature.

Layer	Where	What it proves	Key
SPDM	MEASUREMENTS.signature	Responder identity + L1/L2 transcript integrity	Identity key (normally slot 0)
TPM Quote	opaque_data (OpaqueDataFmt1, SPDM_REGISTRY_ID_TCG)	PCR digests attested by TPM (TPM2B_ATTEST + TPMT_SIGNATURE)	Restricted IAK (slot 1; Quote only)

Clarifications on the points raised in this issue:

1. Field placement
   Keep MEASUREMENTS.signature as the SPDM L1/L2 transcript signature. Put TPM2B_ATTEST + TPMT_SIGNATURE in opaque_data (TCG element), not in signature.
2. Trust boundary (see “Signed GET_MEASUREMENTS with TPM Quote evidence” in the diagram)
   The verifier should check both layers independently. Quote extraData should bind the request nonce (32 bytes), not the responder response nonce.
3. Key separation
   DIGESTS/GET_CERTIFICATE retrieve both slots before CHALLENGE; cache the IAK slot for Quote verification only. IAK should not sign CHALLENGE / MEASUREMENTS / KEY_EXCHANGE. KEY_EXCHANGE should stay on the identity-key path.
   This is the split I’m proposing. Feedback welcome on whether it matches what you had in mind when you tried Quote earlier.

[itsManjeet]

Sorry for the late reply. I reviewed the proposal again.

The current implementation uses the TMP to read the PCR values and returns them through the normal SPDM measurement flow. These measurement records are already protected by the SPDM MEASUREMENTS.signature, so the requester can verify the responder and the integrity of the returned measurements.

Yes, adding TPM2_Quote would provide an additional TPM native attestation layer. I think keeping the normal SPDM signature and carrying the Quote separately in opaque_data makes sense, rather than replacing MEASUREMENTS.signature.

The requester would then verify both:

• the normal SPDM measurement signature;
• the TPM Quote.

The requester can also calculate the PCR digest from the values returned in measurement_record and compare it with the pcrDigest signed by the TPM in the Quote.

Using the GET_MEASUREMENTS request nonce as the Quote’s extraData also looks reasonable for freshness.

I am not fully sure about the proposed key handling, especially whether the IAK certificate should be placed in slot 1 and how that slot would be associated with the Quote. I am also not sure whether SPDM_REGISTRY_ID_TCG already defines a suitable format for carrying TPM2B_ATTEST and TPMT_SIGNATURE, or whether an additional format definition is needed.

@jyao1, could you please review these parts and confirm whether the proposed slot, key and opaque-data handling is correct?

I will try to get some time this week to work on this.

Also, since the TpM implementation and the affected callbacks are in the libspdm repository, I think libspdm may be a better place for this issue and PR than spdm-emu.

[magickli1]

Hi @itsManjeet,

Thanks for the careful review — this is very helpful. I now have a prototype implementation on a working branch, but it is not a PR and I do not consider the wire format settled. Before turning it into PRs, I’d like to align on the design points you raised so we don’t diverge.

We agree on keeping the normal SPDM signature, carrying the Quote in opaque_data, verifying both layers, comparing the reconstructed PCR digest with the Quote, and binding Quote extraData to the request nonce.

I’d appreciate guidance on three remaining points:

1. IAK slot and Quote association

• Slot 0 = SPDM identity / transcript signing
• Slot 1 = restricted IAK cert only (GET_DIGESTS / GET_CERTIFICATE)
• Opaque payload carries explicit iak_slot_id (sample default 1)
• The IAK slot / KeyPairID cannot be selected for SPDM transcript signing

Are slot 1 and an opaque iak_slot_id acceptable? Any preferred KeyPairID / key-usage fencing across SPDM 1.2 and 1.3 multi-key?

2. Opaque format

SPDM defines the general opaque-data framing and TCG vendor header, but does not appear to define an inner layout for the Quote. I propose an implementation-defined v1 payload:

uint8 version | uint8 iak_slot_id | uint16_le attest_len | uint16_le signature_len | MU(TPM2B_ATTEST) | MU(TPMT_SIGNATURE)

Is this acceptable, or should it align with another TCG/DMTF schema? Which vendor ID policy should the sample use?

3. Repository split

Agreed that libspdm is the right place for the core TPM HAL, callback, and wire-format design/implementation. I will open a linked libspdm issue for that work and keep this issue for the spdm-emu integration pieces: requester policy, provisioning, documentation, and CI. The implementation will be split into repository-specific PRs after the design is agreed.

@jyao1, your confirmation on the slot/key/opaque-data model would be especially helpful before I turn the prototype into PRs.